To add slightly, a "pull" backup from a second backup storage system is possibly a less likely to be a route that an attacker could take from your production sy

To add slightly, a "pull" backup from a second backup storage system is possibly a less likely to be a route that an attacker could take from your production system to compromise backups vs a "push" backup from a more open production system. So, for example, ssh key access from backup to production, but not vice versa. Definitely keeping that backup system as simple and low access as possible.